Security at Royaltyport

Data protection and encryption

Customer data is encrypted in transit and at rest. We use encrypted connections to protect information moving between users, our application and supporting services.

Access to production credentials and secrets is restricted to authorised personnel and managed through dedicated secret-storage and password-management tools.

Infrastructure security

Royaltyport operates on managed cloud infrastructure, including Vercel, Supabase and Google Cloud. We combine our providers’ infrastructure protections with application-level access controls, tenant separation and production monitoring.

Customer data is logically separated, with permissions enforced at the application and database levels. Data residency options are available by agreement, including specific European or US configurations.

Access control

Access to customer information is governed by role-based permissions. Customers can manage who has access to their organisation, projects and datasets.

The platform supports single sign-on, which can be required across a customer’s organisation. Royaltyport personnel use individually assigned accounts, and privileged access to our production platform is protected by multi-factor authentication through our identity provider.

Internal access is limited according to responsibilities and business need.

Secure development

We use version control, code review, automated testing and CI/CD checks to support secure software development and controlled releases.

Development and testing environments are separated from production. Synthetic or anonymised data is used for development and testing where technically feasible.

Security issues are assessed and prioritised according to their severity and potential impact. Our security policies define responsibilities for remediation and change management.

Security monitoring and incident response

We use automated monitoring to detect security-relevant events, service failures and performance degradation across our production application and infrastructure. This includes monitoring authentication failures, access denials, firewall events, privileged security changes and application errors.

Alerts are routed to designated technical responders through a configured escalation process. We also monitor interruptions in log collection. Centralised production logs are retained for 90 days to support troubleshooting and security investigations.

Our Incident Response Plan defines how we assess, contain and recover from security incidents, preserve evidence and communicate with affected customers. We review incidents to identify improvements and reduce the likelihood of recurrence.

Service availability updates are published on our status page.

Backups and business continuity

We maintain daily backups of production databases and customer documents to support recovery from data loss or service disruption.

Our Business Continuity and Disaster Recovery Plan defines responsibilities and procedures for maintaining critical operations and restoring services. Backup retention and recovery arrangements are managed according to our data-management and continuity policies.

Privacy and customer data

Customers retain ownership of their data. Our Data Processing Agreement describes our responsibilities when processing personal data on their behalf, including confidentiality, subprocessors and assistance with data-protection requests.

Authorised users can retrieve source documents and export their data through supported product features and interfaces. We support requests concerning access, correction and deletion in accordance with our contractual obligations and applicable requirements.

Supplier security

We assess suppliers according to their role, access and risk. Reviews of critical providers include available independent assurance reports, such as SOC 2 reports, and relevant data-processing agreements.

We maintain a central supplier register and track supplier risk assessments.

Security governance and compliance

Our security programme is supported by documented policies covering access control, secure development, data management, incident response, business continuity, personnel security and supplier management.

We maintain our control framework, track evidence and support ongoing security reviews.

Relevant security policies and supporting documentation are available to customers and prospective customers upon request, subject to appropriate confidentiality arrangements.

Contact security

For security questions or to report a suspected vulnerability or incident, contact security@royaltyport.com.

Please avoid including passwords, access tokens or sensitive customer information in your initial message. We can arrange a suitable channel for sharing further details.